5

I know how to set up vanilla container-managed security that uses form authentication and uses digested passwords (say, SHA-256). Something like this:

web.xml

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>jdbc</realm-name>
    <form-login-config>
        <form-login-page>/login.jsf</form-login-page>
        <form-error-page>/login-error.jsf</form-error-page>
    </form-login-config>
</login-config>

login.xhtml

<form action="j_security_check">
    <p><label>
        Username:<br/>
        <input type="text" name="j_username" />
    </label></p>
    <p><label>
        Password:<br/>
        <input type="password" name="j_password" />
    </label></p>
    <p>
        <button type="submit">Submit</button>
    </p>
</form>

Pretty darn simple - but what I'd really like to be able to do is salt the password with a global salt and the username. Yes, I am aware that this isn't ideal but right now, I'm just building a proof-of-concept.

Can the container (GlassFish 3, in this case) do this for me, or do I have to write my own login filter? I've done it before (for J2EE applications) but my gut tells me that there's got to be a tighter way to do it now that I'm using Java EE 6.

Community
  • 1
  • 1
Matt Ball
  • 354,903
  • 100
  • 647
  • 710
  • Is anyone else surprised that all the default security realms neglect to salt the password? And that there still doesn't seem to be a simple way to get the passwords salted apart from rolling your own login module? – Stijn de Witt Jun 04 '15 at 07:21

1 Answers1

3

I get the feeling you're looking for a quick (& potentially dirty?) way to modify the build-in authentication provider.

The proper way to go is to implement your own Java Authentication Service Provider for the new JASPIC API (JSR-196). It is more laborious, but this method lets you roll your implementation any way you like it, and it should be compatible with any Java EE 6 application server.

For a basic authentication scheme with password salting, implementing such a provider should be pretty straightforward. You will have to think about managing users and passwords, but one solution could be to let your provider re-use the users defined in the Glassfish authentication realms, so that you only have to manage the custom salted passwords yourself.

There's a nice tutorial for WebSphere, which you should be able to adapt for Glassfish here.

Kim Burgaard
  • 3,508
  • 18
  • 11
  • 3
    The WebSphere tutorial has moved: http://pic.dhe.ibm.com/infocenter/wasinfo/v8r0/index.jsp?topic=%2Fcom.ibm.websphere.zseries.doc%2Finfo%2Fzseries%2Fae%2Ftsec_jaspi_develop.html – Markus Eisele Aug 28 '12 at 07:05